Stack pivot detection systems and methods

Abstract

The present disclosure is directed to systems and methods for detecting stack-pivot attacks in a processor-based device. Processor circuitry executes one or more applications via sequential execution of instructions on a stack. Stack pivot attacks occur when an attacker takes control of the stack and uses the stack to execute a series of code sections referred to as “gadgets.” A stack-pivot attack detector establishes an allowable processor stack offset change value associated with an application and monitors a processor stack offset change value responsive to an occurrence of a processor stack exchange instruction. A stack-pivot attack is detected when the processor offset change value exceeds the allowable processor stack offset change value. Upon detecting a stack-pivot attack, the stack-pivot detection circuitry causes the selective termination of the application.

What is claimed: 
     
         1 . A system to detect processor stack-pivot attacks, the system comprising:
 processor circuitry;   a memory communicably coupled to the processor circuitry; and   a storage device that includes instructions that, when executed by the processor circuitry causes the processor circuitry to:
 determine an allowable processor stack offset change value for an application executed by the processor circuitry; 
 detect an occurrence of a processor stack exchange instruction and a processor stack update in the application executed by the processor circuitry; 
 determine a processor stack offset change value for the application responsive to detection of the processor stack exchange instruction and the resultant processor stack update; 
 compare the determined processor stack offset change value to the determined allowable processor stack offset change value for the application; and 
 cause a selective termination of the application responsive to a detected stack-pivot indicated by the determined processor stack offset change value exceeding the determined allowable processor stack offset change value. 
   
     
     
         2 . The system of  claim 1  wherein the instructions, when executed by the processor circuitry, further cause the processor circuitry to:
 cause a selective execution of the application responsive to a determination that the processor stack offset change value is less than or equal to the defined allowable processor stack offset change value. 
 
     
     
         3 . The system of  claim 1  wherein the instructions that cause the processor circuitry to determine an allowable processor stack offset change value for an application executed by the processor circuitry further cause the processor circuitry to:
 determine a respective allowable processor stack offset change value for each application included in a plurality of applications executed by the processor circuitry. 
 
     
     
         4 . The system of  claim 3  wherein the instructions that cause the processor circuitry to detect an occurrence of a processor stack exchange instruction and a processor stack update in the application executed by the processor circuitry further cause the processor circuitry to:
 detect an occurrence of a processor stack exchange instruction and a processor stack update in one or more applications included in the plurality of applications executed by the processor circuitry. 
 
     
     
         5 . The system of  claim 4  wherein the instructions that cause the processor circuitry to determine a processor stack offset change value for the application responsive to detection of the processor stack exchange instruction and the resultant processor stack update further cause the processor circuitry to:
 determine a respective processor stack offset change value for each of the one or more applications responsive to detection of the respective processor stack exchange instruction and the processor stack update in the application. 
 
     
     
         6 . The system of  claim 5  wherein the instructions that cause the processor circuitry to compare the determined processor stack offset change value to the determined allowable processor stack offset change value further cause the processor circuitry to:
 compare each of the respective determined processor stack offset change value for each of the one or more applications to the determined allowable processor stack offset change value associated with the respective application. 
 
     
     
         7 . The system of  claim 6  wherein the instructions that cause the processor circuitry to cause a selective termination of the application responsive to a detected stack-pivot indicated by the determined processor stack offset change value exceeding the determined allowable processor stack offset change value further cause the processor circuitry to:
 cause selective termination of each of the one or more applications responsive to a detected stack-pivot in the application indicated by the respective determined processor stack offset change value for the application exceeding the respective determined allowable processor stack offset change value for the application. 
 
     
     
         8 . The system of  claim 7  wherein the instructions further cause the processor circuitry to:
 cause selective execution of the one or more applications responsive to a determination that the respective processor stack offset change value for the application is less than or equal to the respective defined allowable processor stack offset change value for the application. 
 
     
     
         9 . The system of  claim 1  wherein the instructions that cause the processor circuitry to detect an occurrence of a processor stack exchange instruction and a processor stack update in the application further cause the processor circuitry to:
 selectively provide a watching service called by at least one of: an event handler, an intercepted function binary instrumentation, or the system scheduler, the watching service to detect an occurrence of a processor stack exchange instruction and a processor stack update in the application. 
 
     
     
         10 . A method to detect processor stack pivoting attacks, the method comprising:
 determining, by processor circuitry, an allowable processor stack offset change value for an application executed by the processor circuitry;   detecting, by the processor circuitry, an occurrence of a processor stack exchange instruction and a processor stack update in the application executed by the processor circuitry;   determining, by the processor circuitry, a processor stack offset change value for the application responsive to detection of the processor stack exchange instruction and the processor stack update;   comparing, by the processor circuitry, the determined processor stack offset change value to the determined allowable processor stack offset change value; and   causing, by the processor circuitry, selective termination of the application responsive to a detected stack-pivot indicated by the determined processor stack offset change value exceeding the determined allowable processor stack offset change value.   
     
     
         11 . The method of  claim 10 , further comprising:
 causing, by the processor circuitry, selective execution of the respective application responsive to the determined processor stack offset change value being less than or equal to the determined allowable processor stack offset change value.   
     
     
         12 . The method of  claim 10  wherein determining an allowable processor stack offset change value for an application executed by the processor circuitry further comprises:
 determining, by the processor circuitry, an allowable processor stack offset change value for each application included in a plurality of applications executed by the processor circuitry. 
 
     
     
         13 . The method of  claim 12  wherein detecting an occurrence of a processor stack exchange instruction and a processor stack update in the application executed by the processor circuitry further comprises:
 detecting, by the processor circuitry, an occurrence of a processor stack exchange instruction and a processor stack update in one or more applications included in the plurality of application executed by the processor circuitry. 
 
     
     
         14 . The method of  claim 13  wherein determining a processor stack offset change value during execution of at least one application responsive to detecting the processor stack exchange instruction and the resultant processor stack update further comprises:
 determining, by the processor circuitry, a respective processor stack offset change value for each of the one or more applications responsive to detection of the respective processor stack exchange instruction and the processor stack update in the application. 
 
     
     
         15 . The method of  claim 14  wherein comparing the determined processor stack offset change value to the determined allowable processor stack offset change value further comprises:
 comparing, by the processor circuitry, each respective determined processor stack offset change value for each of the one or more applications to a respective determined allowable processor stack offset change value for the respective application. 
 
     
     
         16 . The method of  claim 14  wherein causing selective termination of the application responsive to a detected stack-pivot indicated by the determined processor stack offset change value exceeding the determined allowable processor stack offset change value further comprises:
 causing, by the processor circuitry, selective termination of each of the one or more applications responsive to a detected stack-pivot indicated by the respective determined processor stack offset change value for the application exceeding the respective determined allowable processor stack offset change value for the application. 
 
     
     
         17 . The method of  claim 16 , further comprising:
 causing, by the processor circuitry, execution of the one or more applications responsive to a determination that the respective processor stack offset change value for the application is less than or equal to the respective defined allowable processor stack offset change value for the application.   
     
     
         18 . A non-transitory computer readable medium that includes instructions that, when executed by processor circuitry causes the processor circuitry to:
 determine an allowable processor stack offset change value for an application executed by the processor circuitry;   detect an occurrence of a processor stack exchange instruction and a processor stack update in the application executed by the processor circuitry;   determine a processor stack offset change value for the application responsive to detection of the processor stack exchange instruction and the resultant processor stack update;   compare the determined processor stack offset change value to the determined allowable processor stack offset change value for the application; and   cause a selective termination of the application responsive to a detected stack-pivot indicated by the determined processor stack offset change value exceeding the determined allowable processor stack offset change value.   
     
     
         19 . The non-transitory computer readable medium of  claim 18  wherein the instructions further cause the processor circuitry to:
 cause a selective execution of the application responsive to a determination that the processor stack offset change value is less than or equal to the defined allowable processor stack offset change value. 
 
     
     
         20 . The non-transitory computer readable medium of  claim 18  wherein the instructions that cause the processor circuitry to determine an allowable processor stack offset change value for an application executed by the processor circuitry further cause the processor circuitry to:
 determine a respective allowable processor stack offset change value for each application included in a plurality of applications executed by the processor circuitry. 
 
     
     
         21 . The non-transitory computer readable medium of  claim 20  wherein the instructions that cause the processor circuitry to detect an occurrence of a processor stack exchange instruction and a processor stack update in the application executed by the processor circuitry further cause the processor circuitry to:
 detect an occurrence of a processor stack exchange instruction and a processor stack update in one or more applications included in the plurality of applications executed by the processor circuitry. 
 
     
     
         22 . The non-transitory computer readable medium of  claim 21  wherein the instructions that cause the processor circuitry to determine a processor stack offset change value for the application responsive to detection of the processor stack exchange instruction and the resultant processor stack update further cause the processor circuitry to:
 determine a respective processor stack offset change value for each of the one or more applications responsive to detection of the respective processor stack exchange instruction and the processor stack update in the application. 
 
     
     
         23 . The non-transitory computer readable medium of  claim 22  wherein the instructions that cause the processor circuitry to compare the determined processor stack offset change value to the determined allowable processor stack offset change value further cause the processor circuitry to:
 compare each of the respective determined processor stack offset change value for each of the one or more applications to the determined allowable processor stack offset change value associated with the respective application. 
 
     
     
         24 . The non-transitory computer readable medium of  claim 23  wherein the instructions that cause the processor circuitry to cause a selective termination of the application responsive to a detected stack-pivot indicated by the determined processor stack offset change value exceeding the determined allowable processor stack offset change value further cause the processor circuitry to:
 cause selective termination of each of the one or more applications responsive to a detected stack-pivot in the application indicated by the respective determined processor stack offset change value for the application exceeding the respective determined allowable processor stack offset change value for the application. 
 
     
     
         25 . The non-transitory computer readable medium of  claim 24  wherein the instructions further cause the processor circuitry to:
 cause selective execution of the one or more applications responsive to a determination that the respective processor stack offset change value for the application is less than or equal to the respective defined allowable processor stack offset change value for the application.